I want to delete data for a source as we are seeing sensitive information in it. Can I use | delete for that source? Once we fix the maxing issue, we can start pulling logs from that source and we can search it right? Please let me know. ... View more

Thanks for the response. What I am seeing is as follows: Deploy server=Windows 2008R2 Heavy Forwarder=Debian. When I deploy the Splunk on Splunk app from the Windows box to Linux, the Python scripts do not retain their execute flag. I installed heavy forwarder as root. Splunkd is running as root. I can chmod the files after deployment. I have seen others that have tried to do this with scripts, but the posts were a couple of years old. What you state about the process having the rights makes me wonder what I might be missing. Can you elaborate on the rights that the process needs? ... View more

I found the solution at last. These events were generated by an app by splunk SA-Eventgen. We were using PCI compliance app and while installation it seems this app was configured by default. After disabling the app these sample logs disappeared. I found the solution in the Splunk security app FAQs. http://docs.splunk.com/Documentation/ES/2.4/User/FAQ#How_do_I_manually_enable_eventgen.3F But the same is not included in PCI compliance app documentation. Hope splunk sees this and update the PCI compliance app documentation. Regards, Harish ... View more

I will try this out. Thanks okrabbe ... View more

Thankq that helped and worked. Regards, Harish ... View more

I am actually using splunk forwarder. Is it possible to specify in splunk forwarding config files or write some script to filter out the my application logs. Regards, Harish ... View more